NetworkMiner vs TShark
NetworkMiner
netresec.comTShark
wireshark.orgSide by side
| Figure | NetworkMiner | TShark |
|---|---|---|
| Price from | Free | Free |
| Free plan | Yes | Yes |
| Free trial | — | — |
| Open source | — | — |
| Windows | Yes | Yes |
| macOS | Yes | Yes |
| Linux | Yes | Yes |
| Plans published | 3 | 1 |
| Spec score · Network Packet Capture Software | 8.2 (#4) | 7.3 (#17) |
| Spec score · Network Protocol Analyzers | 8.2 (#7) | 7.4 (#25) |
| Spec score · Network Packet Analyzer Software | 8.3 (#8) | 7.4 (#27) |
| Protocol analysis | Professional supports file extraction from FTP, TFTP, HTTP, HTTP/2, SMB, SMB2, SMTP, POP3, IMAP and LPR protocols. | TShark provides display filters for selecting packets and protocol fields, using the same syntax as Wireshark. |
| Purpose | NetworkMiner extracts artifacts such as files, images, emails and passwords from captured network traffic in PCAP files and can sniff live network traffic. | TShark captures live network traffic or reads saved captures, then decodes packets for output or writes them to a file. |
Plans
NetworkMiner
- Free EditionFree
- Single User License$1,300, paid once
- Corporate License$6,500, paid once
In their own words
NetworkMiner
NetworkMiner analyzes captured network traffic and can sniff live traffic, extracting artifacts such as files, images, emails, and passwords from PCAP files. It also builds a host inventory from IP address information for passive asset discovery and communication overviews. The free edition supports live sniffing and PCAP and ETL parsing on Windows and Linux, but not PcapNG parsing. Professional accepts PcapNG, Pcap-over-IP, and PacketCache data in addition to PCAP, ETL, and live sniffing, and exports results to CSV, JSON-LD, and XML. Its protocol features include file extraction across listed protocols, while VoIP support includes audio extraction from unencrypted calls. Professional also provides OSINT lookups for hashes, IP addresses, domains, and URLs. NetworkMiner does not decrypt HTTPS or other TLS-encrypted sessions. Extracted data stays on the end-user device rather than in the cloud. The source code is GPLv2 free and open source. Netresec warns that opening PCAPs can automatically extract malware and recommends Linux or Windows Sandbox to reduce self-infection risk.
TShark
TShark is the Wireshark project's terminal-mode utility for capturing and analyzing network traffic. It can capture live packets or read saved captures, decode packet data for output, and write captures to a file. Its native capture format is pcapng, and it can read and write formats supported by Wireshark. Display filters use Wireshark syntax to select packets and protocol fields. Output formats include fields, JSON, PDML, and text; capture controls include interface selection, capture filters, packet limits, and ring-buffer files. TShark can write ElasticSearch mapping data or pipe packet output to another program or script. One constraint is that display filters are unavailable when capturing and saving packets with the -w option. The manual sets a 2 TB maximum capture-file size and notes potential issues above 2^32 packets. The Wireshark project is maintained by the Wireshark Foundation, a nonprofit supported by donations. TShark is free under GNU GPL version 2 and runs on Linux, macOS, and Windows.